A well-known vulnerability analyst has publicly criticized the Microsoft Security Response Center (MSRC) for refusing to process a detailed bug report without a proof-of-concept (POC) video. He noted that requiring POC videos is not standard practice across the industry; organizations like CISA and the UK’s National Cyber Security Centre (NCSC) typically accept written reports with optional supplementary files. The incident underscores broader concerns about how technology companies handle vulnerability disclosures and engage with security researchers. Will Dormann, a senior principal vulnerability analyst, reported a bug to MSRC with a clear written explanation and supporting screenshots. The cybersecurity community has largely sided with Dormann, emphasizing that clear written documentation should suffice for vulnerability disclosures. Dormann expressed frustration over this demand, pointing out that the video would merely replicate the actions already depicted in his screenshots, typing commands and observing Windows responses on the screen. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The incident has sparked debate within the cybersecurity community about the necessity of video submissions for vulnerability disclosures. Ironically, when Dormann attempted to upload the video to Microsoft’s portal, the submission failed due to a 403 error. Dormann further elaborated on his frustrations via social media, stating that researchers who take time to report vulnerabilities deserve better treatment. He revealed that two of his recent reports were delayed due to MSRC’s insistence on video evidence, while another was outright rejected without proper review. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 17 Mar 2025 11:00:06 +0000